@@ -0,0 +1,18 @@
+---
+'@objectstack/service-storage': patch
+---
+
+fix(service-storage)!: a stored file's uploader is the user who created it, as an attachment's and a comment's author are
+
+Clause-②: no (narrowing) — a non-system create of `sys_file` records the session's user as `owner_id`, whatever the request carries, and one whose session names no signed-in user is refused. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, and no stored row is read, rewritten, converted or dropped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime accept set on one platform-written column of one platform object, `sys_file.owner_id`, whose value is recorded once at creation; the remedy for a writer that needs another value recorded is a system-context write, which no ledger entry can derive. The other categories are closed on facts: the bumped package publishes (not unpublished); no ADR-0087 id covers this column and this diff adds none (not registered, not already-registered); no export is added, removed or retyped, so no interface or type narrows (not runtime-export-retired, runtime-interface-only or type-surface-only). -->
+
+**BREAKING** accept-set narrowing on `sys_file` creates (`@objectstack/service-storage`), served by every data door (REST, MCP, the console).
+
+- **Now.** A stored file's uploader is the user who created it, as an attachment's (`sys_attachment.uploaded_by`) and a comment's (`sys_comment.author_id`) author are. A non-system create of `sys_file` records the session's user as `owner_id`, over whatever the request carries. The column was already read-only on update, so the stamp is the row's uploader for life.
+- **Refused.** A non-system create of `sys_file` whose session names no signed-in user is refused with 403 `RECORD_NOT_ACCESSIBLE`, the answer an attachment or comment create with no signed-in user already gets: there is no user to record as the uploader.
+- **Unchanged.** The upload doors (presigned, chunked, complete) already record the signed-in user under the system context, and keep doing so. System-context writes (seeds, imports, migrations) keep the `owner_id` they supply, as does a programmatic create with no session at all on a bare kernel. An update of `owner_id` is dropped and reported in `droppedFields`, as before. Stored rows keep what they were written with. The console needs no change: it never creates `sys_file` rows through the data API.
+
+**The remedy.** None for the console or the upload doors. A client that creates a `sys_file` row through the data API gets the row recorded under its own user, whatever `owner_id` it sends; to record a different uploader, write from a system context (a migration or an import). A server-side caller that creates `sys_file` rows with no signed-in user runs as the system principal or names the user it acts for.
@@ -179,10 +179,14 @@ rendering these files. Only a file marked `acl: 'public_read'` is served to a
 caller with no session: mark a file that way when it must render before sign-in.
 
 The upload entry points (presigned / chunked) likewise require a session when
-an auth service is wired, and stamp `owner_id` on the new `sys_file`. The
-file's uploader is read-only after creation, as an attachment's is: an update
-drops a non-system caller's `owner_id` (a holder of the ownership-transfer
-grant included) and reports it in `droppedFields`.
+an auth service is wired, and stamp `owner_id` on the new `sys_file`. A stored
+file's uploader is the user who created it, as an attachment's is: a
+`sys_file` created through the data API records the signed-in user as
+`owner_id`, whatever the request carries, and a create whose session names no
+signed-in user is refused (`RECORD_NOT_ACCESSIBLE`, 403). The file's uploader
+is read-only after creation: an update drops a non-system caller's `owner_id`
+(a holder of the ownership-transfer grant included) and reports it in
+`droppedFields`. Only a system-context write records a different uploader.
 
 ## Storage-byte lifecycle
 
 
@@ -716,16 +716,19 @@ describe('attachments permission matrix (#2755)', () => {
 // join row's `uploaded_by` and the file's `owner_id` both declare `readonly`,
 // so the data door strips a non-system caller's value on update and reports it
 // in `droppedFields`, while the rest of the write lands. Their create stamps
-// are pinned in the matrix above, (e) and (f); a system write keeps the value
-// it supplies. Org-bound like the matrix: memberA holds the attachment-manager
+// are pinned in the matrix above, (e) and (f), and the file's at the data door
+// below: a stored file's uploader is the user who created it, as an
+// attachment's and a comment's author are. A system write keeps the value it
+// supplies. Org-bound like the matrix: memberA holds the attachment-manager
 // set and PATCHes the join row it created, which the floor admits; only an
-// administrator reaches a `sys_file` PATCH (the baseline names no grant on it).
+// administrator reaches a `sys_file` create or PATCH (the baseline names no
+// grant on it).
 describe('attachments: a row\'s uploader is read-only after creation (sys_attachment.uploaded_by, sys_file.owner_id)', () => {
   let stack: VerifyStack;
   let rootDir: string;
   let ql: any;
   let adminTok: string, memberATok: string;
-  let memberAId: string, memberBId: string;
+  let adminId: string, memberAId: string, memberBId: string;
   let caseAId: string;
 
   const uid = async (email: string) =>
@@ -756,11 +759,14 @@ describe('attachments: a row\'s uploader is read-only after creation (sys_attach
     memberATok = await stack.signUp('att-ro-member-a@verify.test');
     await stack.signUp('att-ro-member-b@verify.test');
     ql = await stack.kernel.getServiceAsync('objectql');
+    adminId = await uid('admin@objectos.ai');
     memberAId = await uid('att-ro-member-a@verify.test');
     memberBId = await uid('att-ro-member-b@verify.test');
+    expect(adminId, 'the administrator resolved').toBeTruthy();
     expect(memberAId, 'memberA resolved').toBeTruthy();
     expect(memberBId, 'memberB resolved, a different user').toBeTruthy();
     expect(memberBId).not.toBe(memberAId);
+    expect(adminId).not.toBe(memberBId);
     const managerSet = await catalogPermissionSet(ql, 'att_attachment_manager');
     expect(managerSet, 'fixture permission set served by the security catalog').toBeTruthy();
     await ql.insert('sys_user_permission_set', { user_id: memberAId, permission_set: managerSet.name }, { context: { ...SYS } });
@@ -815,6 +821,19 @@ describe('attachments: a row\'s uploader is read-only after creation (sys_attach
     expect((await ql.findOne('sys_attachment', { where: { id: attachmentId }, context: SYS }))?.uploaded_by).toBe(memberBId);
     expect((await ql.findOne('sys_file', { where: { id: fileId }, context: SYS }))?.owner_id).toBe(memberBId);
   });
+
+  it('a stored file\'s uploader is the user who created it: an administrator\'s data-door create naming another user answers 201 and records the administrator', async () => {
+    const created = await stack.apiAs(adminTok, 'POST', '/data/sys_file', { name: 'created.txt', owner_id: memberBId });
+    expect(created.status, 'the create is admitted').toBe(201);
+    const file = await ql.findOne('sys_file', { where: { id: await createdId(created) }, context: SYS });
+    expect(file?.owner_id, 'the creator, not the user the request named').toBe(adminId);
+    expect(file?.name, 'the rest of the row lands').toBe('created.txt');
+  });
+
+  it('control: a system create keeps the uploader it supplies', async () => {
+    const created = await ql.insert('sys_file', { name: 'imported.txt', owner_id: memberBId }, { context: { ...SYS } });
+    expect((await ql.findOne('sys_file', { where: { id: created.id }, context: SYS }))?.owner_id).toBe(memberBId);
+  });
 });
 
 // ── (a′) without service-storage, the floor is the last word (#21729) ────
 
@@ -182,7 +182,11 @@ export const SystemFile = ObjectSchema.create({
 
     // The uploader: a row's uploader is read-only after creation, like a
     // comment's author. The upload doors record it from the session, under
-    // the system context; `readonly` makes the engine's update-side strip drop
+    // the system context, and any other create records the session's user,
+    // over whatever it carried, or is refused when the session names none
+    // (`sys-file-storage-owned-columns.ts`, "The uploader"), so a stored
+    // file's uploader is the user who created it; `readonly` makes the
+    // engine's update-side strip drop
     // a non-system caller's value and report it (`droppedFields`), a holder of
     // the ownership-transfer grant included, since this column is authorship
     // and not a transferable record owner. The reason is provenance
 
@@ -24,6 +24,12 @@
  * create-side guard drops them from a non-system create, while the lifecycle's
  * claim, release and copy, all under the system context, still write them.
  *
+ * The same guard records the row's uploader: a stored file's uploader
+ * (`owner_id`) is the user who created it, as an attachment's and a comment's
+ * author are. A non-system create records the caller over whatever it named,
+ * and one whose context names no user is refused; the upload doors and every
+ * system write keep the uploader they record.
+ *
  * Driven through the doors as they ship, as the #26479 rig is: one real
  * `ObjectQL` engine over sqlite `:memory:`, `StorageServicePlugin` booted on
  * the local adapter, the upload doors called as routes, and the data writes
@@ -435,4 +441,67 @@ describe('sys_file storage-owned columns are not writable outside the storage se
     expect(typeof copyRow.key === 'string' && copyRow.key.length > 0, JSON.stringify(copyRow)).toBe(true);
     expect(copyRow.key).not.toBe(committedRow.key);
   });
+
+  // ── The uploader (`owner_id`) ──────────────────────────────────────
+
+  const SOMEONE_ELSE = 'u_someone_else';
+  const uploaderOf = async (id: string) => (await fileRow(id))?.owner_id ?? null;
+
+  it('a stored file\'s uploader is the user who created it: a create records the caller over an owner_id naming another user', async () => {
+    const fileId = `f_uploader_${++seq}`;
+
+    await engine.insert('sys_file', { id: fileId, name: 'mine.png', owner_id: SOMEONE_ELSE } as any, { context: WRITER_CTX });
+
+    expect(await uploaderOf(fileId)).toBe(WRITER);
+    expect((await fileRow(fileId))?.name).toBe('mine.png');
+  });
+
+  it('a batch create records the caller as the uploader on every row', async () => {
+    const a = `f_uploader_${++seq}`;
+    const b = `f_uploader_${++seq}`;
+
+    await engine.insert('sys_file', [
+      { id: a, name: 'a.png', owner_id: SOMEONE_ELSE },
+      { id: b, name: 'b.png' },
+    ] as any, { context: WRITER_CTX });
+
+    expect(await uploaderOf(a)).toBe(WRITER);
+    expect(await uploaderOf(b)).toBe(WRITER);
+  });
+
+  it('a create whose context names no signed-in user is refused 403 RECORD_NOT_ACCESSIBLE, and no row is written', async () => {
+    const fileId = `f_uploader_${++seq}`;
+
+    expect(await failureOf(
+      engine.insert('sys_file', { id: fileId, name: 'nobody.png', owner_id: SOMEONE_ELSE } as any, { context: { actor: 'svc:flow:importer' } as any }),
+    )).toMatchObject({ status: 403, code: 'RECORD_NOT_ACCESSIBLE' });
+    expect(await fileRow(fileId)).toBeUndefined();
+  });
+
+  it('the upload doors still record the uploading user, under the system context', async () => {
+    const { fileId: presigned } = await presign();
+    expect(await uploaderOf(presigned)).toBe(WRITER);
+
+    const committed = await committedUpload();
+    expect(await uploaderOf(committed)).toBe(WRITER);
+  });
+
+  it('a system create and a system update keep the uploader they write', async () => {
+    const fileId = `f_uploader_${++seq}`;
+
+    await engine.insert('sys_file', { id: fileId, name: 'import.png', owner_id: SOMEONE_ELSE } as any, { context: SYS });
+    expect(await uploaderOf(fileId)).toBe(SOMEONE_ELSE);
+
+    await engine.update('sys_file', { id: fileId, owner_id: WRITER } as any, { context: SYS });
+    expect(await uploaderOf(fileId)).toBe(WRITER);
+  });
+
+  it('an update leaves the uploader the create recorded, whoever sends it', async () => {
+    const fileId = await committedUpload();
+
+    await engine.update('sys_file', { id: fileId, name: 'renamed.png', owner_id: SOMEONE_ELSE } as any, { context: WRITER_CTX });
+
+    expect(await uploaderOf(fileId)).toBe(WRITER);
+    expect((await fileRow(fileId))?.name).toBe('renamed.png');
+  });
 });
@@ -0,0 +1,97 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The create-side guard of `sys_file`, judged at the guard: the handler
+ * {@link installSysFileStorageOwnedColumnsGuard} registers, called with the
+ * hook contexts the engine builds. The real engine around it is
+ * `sys-file-storage-owned-columns.integration.test.ts`.
+ *
+ * The rule pinned here is the uploader's: a stored file's uploader is the user
+ * who created it, as an attachment's and a comment's author are. A non-system
+ * create records the session's user as `owner_id` over whatever it carried, and
+ * one whose session names no signed-in user is refused, as the attachment and
+ * comment create hooks refuse theirs. System context keeps what it supplies,
+ * and so does a call with no session at all (a bare kernel), which the
+ * attachment hook passes the same way.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { installSysFileStorageOwnedColumnsGuard } from './sys-file-storage-owned-columns.js';
+
+type Handler = (ctx: any) => void | Promise<void>;
+
+/** Install the guard on a stand-in engine and hand back its one handler. */
+function installGuard() {
+  const registered: Array<{ event: string; handler: Handler; options: { object: string } }> = [];
+  const logger = { warn: vi.fn() };
+  installSysFileStorageOwnedColumnsGuard(
+    { registerHook: (event, handler, options) => { registered.push({ event, handler, options }); } },
+    logger,
+  );
+  expect(registered.map((r) => [r.event, r.options.object])).toEqual([['beforeInsert', 'sys_file']]);
+  const run = async (session: unknown, data: Record<string, unknown>) => {
+    await registered[0]!.handler({ object: 'sys_file', event: 'beforeInsert', session, input: { data } });
+    return data;
+  };
+  return { run, logger };
+}
+
+/** What a thrown refusal answers, reduced to the two members ADR-0112 makes assertable. */
+async function refusalOf(write: Promise<unknown>): Promise<{ code: unknown; status: unknown } | null> {
+  return write.then(
+    () => null,
+    (err: any) => ({ code: err?.code, status: err?.status }),
+  );
+}
+
+const CREATOR = 'u_creator';
+const SOMEONE_ELSE = 'u_someone_else';
+
+describe('a stored file\'s uploader is the user who created it (sys_file.owner_id on create)', () => {
+  it('a non-system create records the session\'s user as the uploader, over an owner_id naming another user', async () => {
+    const { run } = installGuard();
+    const row = await run({ userId: CREATOR }, { name: 'a.png', owner_id: SOMEONE_ELSE });
+    expect(row.owner_id).toBe(CREATOR);
+    expect(row.name).toBe('a.png');
+  });
+
+  it('a non-system create that names no uploader records the session\'s user', async () => {
+    const { run } = installGuard();
+    expect((await run({ userId: CREATOR }, { name: 'a.png' })).owner_id).toBe(CREATOR);
+  });
+
+  it.each([
+    ['a session that names no user (a service principal)', { actor: 'svc:flow:importer' }],
+    ['a session that names only an organization', { organizationId: 'org_1' }],
+    ['a session whose user id is empty', { userId: '' }],
+  ])('a non-system create is refused 403 RECORD_NOT_ACCESSIBLE when there is no signed-in user to record: %s', async (_label, session) => {
+    const { run, logger } = installGuard();
+    expect(await refusalOf(run(session, { name: 'a.png', owner_id: SOMEONE_ELSE, status: 'committed' }))).toEqual({
+      code: 'RECORD_NOT_ACCESSIBLE',
+      status: 403,
+    });
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('a system create keeps the uploader it supplies', async () => {
+    const { run } = installGuard();
+    const row = await run({ userId: CREATOR, isSystem: true }, { name: 'a.png', owner_id: SOMEONE_ELSE });
+    expect(row.owner_id).toBe(SOMEONE_ELSE);
+  });
+
+  it('a create with no session at all (a bare kernel) keeps the uploader it supplies, and still loses the storage-owned columns', async () => {
+    const { run } = installGuard();
+    const row = await run(undefined, { name: 'a.png', owner_id: SOMEONE_ELSE, status: 'committed', key: 'k' });
+    expect(row.owner_id).toBe(SOMEONE_ELSE);
+    expect(row.status).toBe('pending');
+    expect(row).not.toHaveProperty('key');
+  });
+
+  it('the uploader is recorded beside the storage-owned strip, which still drops the caller\'s columns and starts the row pending', async () => {
+    const { run, logger } = installGuard();
+    const row = await run({ userId: CREATOR }, { name: 'a.png', owner_id: SOMEONE_ELSE, size: 9, status: 'committed' });
+    expect(row).toEqual({ name: 'a.png', owner_id: CREATOR, status: 'pending' });
+    expect(logger.warn).toHaveBeenCalledTimes(1);
+    expect(logger.warn.mock.calls[0]![1]).toMatchObject({ fields: ['size', 'status'] });
+  });
+});